http

优化Http header信息

curl -I yourdomain.com 能看到什么? Server: Apache xxx PHP xxx XXX xxx ,明码实价,一字排开。这是干嘛,卖菜呢?

我们不妨看看 curl -I www.google.com 结果如何:

HTTP/1.1 302 Found
Cache-Control: private
Location: http://sorry.google.com/sorry/?continue=http://www.google.com/
Date: Mon, 12 Jan 2009 06:57:41 GMT
Content-Type: text/html; charset=UTF-8
Server: GFE/1.3
Content-Length: 259

请注意这里 Google 的前端 Web Server 是 GFE/1.3 (Google Front Edge 1.3),至于它具体对应 Apache 1.3.x 还是 Windows 1.3,我们并不知晓。这样就起到了很好的信息隐藏作用,一旦网上发现 Apache 1.3.x 或者 Windows 1.3 的最新漏洞,黑客们并不会直接联想到 GFE/1.3,自然也就不会来多作尝试了。

所以,我们应该把这些不可告人的秘密都隐藏起来,哪怕放一段文字广告(如: [AD: DangDang http://tinyurl.com/2dangdang ][ Your AD Here ][AD: Joyo http://tinyurl.com/2amazon ]),也比卖菜似的一一详细罗列版本要好。

参考解决方案:

1. Lighttpd 1.4.20

src/response.c:108 改为:

buffer_append_string_len(b, CONST_STR_LEN(“\r\nServer: [AD: DangDang http://tinyurl.com/2dangdang ][ Your AD Here ][AD: Joyo http://tinyurl.com/2amazon ]”));

输出 Header:
HTTP/1.1 404 Not Found
Content-Type: text/html
Content-Length: 345
Date: Mon, 12 Jan 2009 13:54:02 GMT
Server: [AD: DangDang http://tinyurl.com/2dangdang ][ Your AD Here ][AD: Joyo http://tinyurl.com/2amazon ]

2. Nginx 0.7.30

src/http/ngx_http_header_filter_module.c:48-49 改为:

static char ngx_http_server_string[] = “Server: [AD: DangDang http://tinyurl.com/2dangdang ][ Your AD Here ][AD: Joyo http://tinyurl.com/2amazon ]” CRLF;
static char ngx_http_server_full_string[] = “Server: [AD: DangDang http://tinyurl.com/2dangdang ][ Your AD Here ][AD: Joyo http://tinyurl.com/2amazon ]” CRLF;

输出 Header:
HTTP/1.1 200 OK
Server: [AD: DangDang http://tinyurl.com/2dangdang ][ Your AD Here ][AD: Joyo http://tinyurl.com/2amazon ]
Date: Mon, 12 Jan 2009 14:01:10 GMT
Content-Type: text/html
Content-Length: 151
Last-Modified: Mon, 12 Jan 2009 14:00:56 GMT
Connection: keep-alive
Accept-Ranges: bytes

3. Cherokee 0.11.6

cherokee/version.c:93 添加:

ret = cherokee_buffer_add_str (buf, “[AD: DangDang http://tinyurl.com/2dangdang ][ Your AD Here ][AD: Joyo http://tinyurl.com/2amazon ]”);
return ret;

输出 Header:
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=15
Date: Mon, 12 Jan 2009 14:54:39 GMT
Server: [AD: DangDang http://tinyurl.com/2dangdang ][ Your AD Here ][AD: Joyo http://tinyurl.com/2amazon ]
ETag: 496b54af=703
Last-Modified: Mon, 12 Jan 2009 14:33:19 GMT
Content-Type: text/html
Content-Length: 1795

4. Apache 2.2.11

server/core.c:2784 添加:

ap_add_version_component(pconf, “[AD: DangDang http://tinyurl.com/2dangdang ][ Your AD Here ][AD: Joyo http://tinyurl.com/2amazon ]”);
return;

输出 Header:
HTTP/1.1 200 OK
Date: Mon, 12 Jan 2009 14:28:10 GMT
Server: [AD: DangDang http://tinyurl.com/2dangdang ][ Your AD Here ][AD: Joyo http://tinyurl.com/2amazon ]
Last-Modified: Sat, 20 Nov 2004 20:16:24 GMT
ETag: “1920edd-2c-3e9564c23b600”
Accept-Ranges: bytes
Content-Length: 44
Content-Type: text/html

5. Squid 3.0 STABLE 11

src/globals.cc:58 改为:

const char *const full_appname_string = “[AD: DangDang http://tinyurl.com/2dangdang ][ Your AD Here ][AD: Joyo http://tinyurl.com/2amazon ]”;

输出 Header:
HTTP/1.0 400 Bad Request
Server: [AD: DangDang http://tinyurl.com/2dangdang ][ Your AD Here ][AD: Joyo http://tinyurl.com/2amazon ]
Mime-Version: 1.0
Date: Mon, 12 Jan 2009 15:25:15 GMT
Content-Type: text/html
Content-Length: 1553
Expires: Mon, 12 Jan 2009 15:25:15 GMT
X-Squid-Error: ERR_INVALID_URL 0
X-Cache: MISS from ‘cache.hutuworm.org’
Via: 1.0 ‘cache.hutuworm.org’ ([AD: DangDang http://tinyurl.com/2dangdang ][ Your AD Here ][AD: Joyo http://tinyurl.com/2amazon ])
Proxy-Connection: close

6. Tomcat 6.0.18

java/org/apache/coyote/http11/Constants.java:56 和 java/org/apache/coyote/ajp/Constants.java:236 均改为:

ByteChunk.convertToBytes(“Server: [AD: DangDang http://tinyurl.com/2dangdang ][ Your AD Here ][AD: Joyo http://tinyurl.com/2amazon ]” + CRLF);

输出 Header:
HTTP/1.1 200 OK
Server: [AD: DangDang http://tinyurl.com/2dangdang ][ Your AD Here ][AD: Joyo http://tinyurl.com/2amazon ]
ETag: W/”7857-1216684872000″
Last-Modified: Tue, 22 Jul 2008 00:01:12 GMT
Content-Type: text/html
Content-Length: 7857
Date: Mon, 12 Jan 2009 16:30:44 GMT

7. JBoss 5.0.0 GA

a. tomcat/src/resources/web.xml:40 改为

[AD: DangDang http://tinyurl.com/2dangdang ][ Your AD Here ][AD: Joyo http://tinyurl.com/2amazon ]

b. 下载 JBoss Web Server 2.1.1.GA srctar (http://www.jboss.org/jbossweb/downloads/jboss-web/)

java/org/apache/coyote/http11/Constants.java:56 和 java/org/apache/coyote/ajp/Constants.java:236 均改为:

ByteChunk.convertToBytes(“Server: [AD: DangDang http://tinyurl.com/2dangdang ][ Your AD Here ][AD: Joyo http://tinyurl.com/2amazon ]” + CRLF);

将编译所得 jbossweb.jar 覆盖 JBoss 编译输出文件:

JBOSS_SRC/build/output/jboss-5.0.0.GA/server/all/deploy/jbossweb.sar/jbossweb.jar
JBOSS_SRC/build/output/jboss-5.0.0.GA/server/standard/deploy/jbossweb.sar/jbossweb.jar
JBOSS_SRC/build/output/jboss-5.0.0.GA/server/default/deploy/jbossweb.sar/jbossweb.jar
JBOSS_SRC/build/output/jboss-5.0.0.GA/server/web/deploy/jbossweb.sar/jbossweb.jar

输出 Header:
HTTP/1.1 200 OK
Server: [AD: DangDang http://tinyurl.com/2dangdang ][ Your AD Here ][AD: Joyo http://tinyurl.com/2amazon ]
X-Powered-By: [AD: DangDang http://tinyurl.com/2dangdang ][ Your AD Here ][AD: Joyo http://tinyurl.com/2amazon ]
Accept-Ranges: bytes
ETag: W/”1581-1231842222000″
Last-Modified: Tue, 13 Jan 2009 10:23:42 GMT
Content-Type: text/html
Content-Length: 1581
Date: Tue, 13 Jan 2009 10:30:42 GM

Tags: ,

星期四, 三月 11th, 2010 服务器 没有评论

HTTP codes

This is examples of current HTTP codes

#[Miscellaneous successes]
“2xx”, “[Miscellaneous successes]”,
“200”, “OK”, # HTTP request OK
“201”, “Created”,
“202”, “Request recorded, will be executed later”,
“203”, “Non-authoritative information”,
“204”, “Request executed”,
“205”, “Reset document”,
“206”, “Partial Content”,
#[Miscellaneous redirections]
“3xx”, “[Miscellaneous redirections]”,
“300”, “Multiple documents available”,
“301”, “Moved Permanently”,
“302”, “Found”,
“303”, “See other document”,
“304”, “Not Modified since last retrieval”, # HTTP request OK
“305”, “Use proxy”,
“306”, “Switch proxy”,
“307”, “Document moved temporarily”,
#[Miscellaneous client/user errors]
“4xx”, “[Miscellaneous client/user errors]”,
“400”, “Bad Request”,
“401”, “Unauthorized”,
“402”, “Payment required”,
“403”, “Forbidden”,
“404”, “Document Not Found”,
“405”, “Method not allowed”,
“406”, “ocument not acceptable to client”,
“407”, “Proxy authentication required”,
“408”, “Request Timeout”,
“409”, “Request conflicts with state of resource”,
“410”, “Document gone permanently”,
“411”, “Length required”,
“412”, “Precondition failed”,
“413”, “Request too long”,
“414”, “Requested filename too long”,
“415”, “Unsupported media type”,
“416”, “Requested range not valid”,
“417”, “Failed”,
#[Miscellaneous server errors]
“5xx”, “[Miscellaneous server errors]”,
“500”, “Internal server Error”,
“501”, “Not implemented”,
“502”, “Received bad response from real server”,
“503”, “Server busy”,
“504”, “Gateway timeout”,
“505”, “HTTP version not supported”,
“506”, “Redirection failed”,
#[Unknown]
“xxx” ,”[Unknown]”

Tags:

星期四, 三月 11th, 2010 网络 没有评论
1LMooBmUE153Wnd3zDryWvDyXxQudbFxDr